Networks used by enterprises may connect many entities (e.g., thousands) such as applications, web browsers, database management systems (DBMSs), servers, clients, routers and firewalls. These entities may generate many thousands of messages such as server requests.
Applications exist which try to model networks or determine topologies, and to determine which entities are connected to or communicating with which other entities. However, this is a very complex task.
Existing tools use ad-hoc and unreliable methods, working only partially. Existing tools produce too many false negatives (not connecting, in a model, entities that are in fact communicating with each other) and false positives (connecting, in a model, entities that are not communicating with each other). In addition, some existing tools need continual maintenance, in particular when new communications protocols or other technology is added to a network.
Existing tools may include a probe (e.g., a process associated with and/or code injected into an entity which may monitor the entity for performance or other reasons) for each of a set of entities communicating with each other. The probe may report, e.g., using a string, to a central process responsible for matching communications among entities. If identifiers in the string match or are matched, the central process may deem that the entities are communicating with each other. Each entity, via a separate probe, may construct a string and pass it to the central process.
Reference numerals may be repeated among the drawings to indicate corresponding or analogous elements. Moreover, some of the blocks depicted in the drawings may be combined into a single function.